i9300 Grouper GPS blobs SElinux update

Change-Id: I3dbb887bd1356a3198a4b4da5aadf95b64920e55

11 files changed, 32 insertions, 12 deletions

diff --git a/rootdir/init.target.rc b/rootdir/init.target.rc
index f75fdb6..e8c2e42 100644
--- a/rootdir/init.target.rc
+++ b/rootdir/init.target.rc
@@ -43,6 +43,9 @@ service cpboot-daemon /sbin/cbd -d
     chmod 0664 /sys/class/sec/gps/GPS_PWR_EN/value
     chown gps system /dev/ttySAC1
     chmod 0660 /dev/ttySAC1
+    restorecon /sys/class/sec/gps/export
+    restorecon /sys/class/sec/gps/GPS_PWR_EN/value
+    restorecon /sys/class/sec/gps/GPS_PWR_EN/direction
 
 # Start GPS daemon
 service gps-daemon /system/bin/glgps -c /system/etc/gps.xml
diff --git a/selinux/bluetooth.te b/selinux/bluetooth.te
index 76e62ea..9d11918 100644
--- a/selinux/bluetooth.te
+++ b/selinux/bluetooth.te
@@ -1,4 +1,6 @@
 allow bluetooth bluetooth_efs_file:dir search;
 allow bluetooth bluetooth_efs_file:file read;
+allow bluetooth firmware_exynos:dir { open read search };
+allow bluetooth firmware_exynos:file { open read };
 allow bluetooth sysfs:file write;
 allow bluetooth efs_device_file:dir search;
diff --git a/selinux/file.te b/selinux/file.te
index 15e8eff..c686d2f 100644
--- a/selinux/file.te
+++ b/selinux/file.te
@@ -1,5 +1,5 @@
 type firmware_mfc, file_type;
-type firmware_camera, file_type;
+type firmware_exynos, file_type;
 
 type sensors_data_file, file_type, data_file_type;
 type sysfs_display, fs_type, sysfs_type;
diff --git a/selinux/file_contexts b/selinux/file_contexts
index 42b5fe4..35e4e99 100644
--- a/selinux/file_contexts
+++ b/selinux/file_contexts
@@ -28,7 +28,7 @@
 
 # GPS
 /dev/ttySAC1                            u:object_r:gps_device:s0
-/system/bin/gpsd                        u:object_r:gpsd_exec:s0
+/system/bin/glgps                       u:object_r:gpsd_exec:s0
 
 # Sensors
 /dev/akm8975                            u:object_r:sensors_device:s0
@@ -39,9 +39,9 @@
 /efs/wifi/.mac.info                     u:object_r:wifi_data_file:s0
 
 # Firmwares
-/system/vendor/firmware(/.*)?           u:object_r:firmware_camera:s0
+/system/vendor/firmware(/.*)?           u:object_r:firmware_exynos:s0
 /system/vendor/firmware/mfc_fw.bin      u:object_r:firmware_mfc:s0
-/data/cfw(/.*)?                         u:object_r:firmware_camera:s0
+/data/cfw(/.*)?                         u:object_r:firmware_exynos:s0
 
 # Vibrator
 /dev/tspdrv                             u:object_r:input_device:s0
diff --git a/selinux/gpsd.te b/selinux/gpsd.te
index 5c7e39c..d58665e 100644
--- a/selinux/gpsd.te
+++ b/selinux/gpsd.te
@@ -1,3 +1,4 @@
+allow gpsd self:process execmem;
 allow gpsd rild:unix_stream_socket connectto;
 allow gpsd system_data_file:fifo_file { create read write setattr open };
 allow gpsd servicemanager:binder call;
diff --git a/selinux/mediaserver.te b/selinux/mediaserver.te
index 6145b7c..43f5b21 100644
--- a/selinux/mediaserver.te
+++ b/selinux/mediaserver.te
@@ -1,5 +1,5 @@
-allow mediaserver { firmware_camera }:file r_file_perms;
-allow mediaserver firmware_camera:dir r_dir_perms;
+allow mediaserver { firmware_exynos }:file r_file_perms;
+allow mediaserver firmware_exynos:dir r_dir_perms;
 allow mediaserver camera_data_file:file rw_file_perms;
 allow mediaserver mfc_device:chr_file rw_file_perms;
 
diff --git a/selinux/nfc.te b/selinux/nfc.te
index b8d1d44..6a6e324 100644
--- a/selinux/nfc.te
+++ b/selinux/nfc.te
@@ -1 +1 @@
-allow nfc firmware_camera:dir search;
+allow nfc firmware_exynos:dir search;
diff --git a/selinux/sysinit.te b/selinux/sysinit.te
index 55e9dc5..0436ffe 100644
--- a/selinux/sysinit.te
+++ b/selinux/sysinit.te
@@ -1,6 +1,7 @@
-allow sysinit firmware_camera:dir { read search open getattr };
+allow sysinit firmware_exynos:dir { read search open getattr };
 allow sysinit userinit_exec:file { getattr execute execute_no_trans read open };
-allow sysinit firmware_camera:dir { read search open getattr write remove_name add_name };
-allow sysinit firmware_camera:file { read open write getattr setattr create unlink };
+allow sysinit firmware_exynos:dir { read search open getattr write remove_name add_name };
+allow sysinit firmware_exynos:file { read open write getattr setattr create unlink };
 allow sysinit sysinit:capability { dac_override chown fowner fsetid };
 allow sysinit unlabeled:dir { search };
+allow sysinit surfaceflinger_exec:file { getattr };
diff --git a/selinux/system_server.te b/selinux/system_server.te
index e42bdd0..a6b65ce 100644
--- a/selinux/system_server.te
+++ b/selinux/system_server.te
@@ -7,6 +7,7 @@ allow system_server sysfs:file { read open write };
 allow system_server self:capability { sys_module };
 
 allow system_server efs_file:dir search;
+allow system_server efs_file:file read;
 allow system_server efs_device_file:dir search;
 allow system_server uhid_device:chr_file { read ioctl write open };
 
@@ -16,3 +17,14 @@ allow system_server wifi_data_file:file { read open };
 allow system_server default_prop:property_service set;
 
 allow system_server gpsd:binder transfer;
+type_transition system_server system_data_file:fifo_file gps_data_file ".gps.interface.pipe.to_jni";
+
+# Access .gps.interface.pipe.to_gpsd.
+allow system_server gps_data_file:dir search;
+allow system_server gps_data_file:fifo_file { write setattr rw_file_perms };
+
+# Access /data/sensors/gps* socket
+allow system_server gps_data_file:sock_file create_file_perms;
+allow system_server gps_data_file:dir rw_dir_perms;
+allow system_server gps_data_file:file rw_file_perms;
+
diff --git a/selinux/ueventd.te b/selinux/ueventd.te
index 1d993e4..8044d34 100644
--- a/selinux/ueventd.te
+++ b/selinux/ueventd.te
@@ -1,4 +1,4 @@
 # Firmwares
 allow ueventd { firmware_mfc }:file r_file_perms;
-allow ueventd { firmware_camera }:dir search;
-allow ueventd { firmware_camera }:file { read getattr open };
+allow ueventd { firmware_exynos }:dir search;
+allow ueventd { firmware_exynos }:file { read getattr open };
diff --git a/selinux/wpa_supplicant.te b/selinux/wpa_supplicant.te
index 6e221e3..c7568f3 100644
--- a/selinux/wpa_supplicant.te
+++ b/selinux/wpa_supplicant.te
@@ -7,4 +7,5 @@ allow wpa wpa_socket:unix_dgram_socket { read write };
 allow wpa_socket system_app:unix_dgram_socket sendto;
 
 allow wpa_socket wifi_data_file:sock_file unlink;
+
 allow wpa rfkill_device:chr_file rw_file_perms;